Wednesday, January 30, 2013

During the security evaluation of Cisco Linksys routers for a client, we have discovered a critical
security vulnerability that allows remote unauthenticated attacker to remotely execute arbitrary code
under root privileges.
Upon initial vulnerability announcement a few weeks ago Cisco spokesman stated that only one router
model is vulnerable - WRT54GL.
We have continued with our research and found that, in fact, same vulnerable firmware component
is also used in at least two other Cisco Linksys models - WRT54G3G and probably WRT310N.
Could be others.

Moreover, vulnerability turns out even more dangerous, since we have discovered that same vulnerable
firmware component is also used across many other big-brand router manufacturers and many
smaller vendors.

Vulnerability itself is located in Broadcom UPnP stack, which is used by many router manufacturers
that produce or produced routers based on Broadcom chipset.
We have contacted them with vulnerability details and we expect patches soon.
However, we would like to point out that we have sent more than 200 e-mails to various router
manufacturers and various people, without much success.

Thursday, January 17, 2013

Starting a few hours ago, we began a quick analysis as to how many
Linksys models might be vulnerable.
From what we can tell so far, at least one other (not just the
WRT54GL) Linksys model is probably vulnerable.

Moreover, during the analysis we discovered clues that network
devices from other manufacturers might
also contain the same vulnerability. We are still investigating.

Regarding the Cisco case, we are looking forward to the
vulnerability fix. In the meantime, we have again approached them about a few other potential vulnerabilities in the Linksys
equipment.